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Abstract 

The constraints of future Exploration Missions will require unique Integrated System Health 
Management (ISHM) capabilities throughout the mission. An ambitious launch schedule, human- 
rating requirements, long quiescent periods, limited human access for repair or replacement, and 
long communication delays, all require an ISHM system that can span distinct, yet interdependent 
vehicle subsystems, anticipate failure states, provide autonomous remediation and support the 
Exploration Mission from beginning to end. NASA Glenn Research Center has developed and 
applied health management system technologies to aerospace propulsion systems for almost two 
decades. Lessons learned from past activities help define the approach to proper ISHM development: 

• Sensor Selection - identifies sensor sets required for accurate health assessment; 

• Data Qualification & Validation - ensures the integrity of measurement data from sensor to 
data system; 

• Fault Detection and Isolation - uses measurements in a component/subsystem context to 
detect faults and identify their point of origin; 

• Information Fusion and Diagnostic Decision Criteria - aligns data from similar and disparate 
sources in time and use that data to perform higher-level system diagnosis; 

• Verification & Validation - uses data, real or simulated, to provide variable exposure to the 
diagnostic system for faults that may only manifest themselves in actual implementation, as 
well as, faults that are detectable via hardware testing. 

This presentation describes a framework for developing health management systems and highlights 
the health management research activities performed by the Controls and Dynamics Branch at the 
NASA Glenn Research Center. It illustrates how those activities contribute to the development of 
solutions for Integrated System Health Management. 
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Health Management System Development Process 

Optimum performance and effectiveness of a health management system (HMS) is achieved when its 
development coincides with the development of the system whose health it is being tasked to 
manage. It is much less effective and efficient when it is implemented after the fact. 

The chart shown above was developed by the NASA Glenn Controls and Dynamics Branch to 
describe its process for developing HMSs. In general, the HMS development process requires a 
thorough understanding of the system being managed. Knowledge acquisition from domain experts 
is essential in establishing the scope of a HMS. A clear set of system requirements and concept of 
operations are some of the first essential elements. A Failure Modes and Effects Analysis must be 
performed to identify the critical faults and document how those faults manifest themselves in the 
system. Also, when development of a health management is incorporated early in the system design, 
little, if any, test data is available and a models of the system are essential. These system models 
must be developed with sufficient detail and complexity so that they provide a sound basis for 
developing and testing the required health management system. 

Focusing on the design requirements for the monitored system, as well as, for the HMS itself, 
elements of the development process may be identified as follows : 

• Sensor Selection 

• Data Validation 

• Fault Detection 

• Fault Isolation 

• Information Fusion 

Note that clear boundaries between these elements do not necessarily exist. There is some overlap 
and distinctions between the elements are not always clear. However, it is useful to address 
technology capabilities and gaps in each of these elements separately. Therefore, in an attempt to 
discuss the advances required for future exploration missions, the charts that follow describe in more 
detail each of the HMS elements identified above. 
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Systematic Sensor Selection Strategy 

Developed in collaboration with 
Christian Brothers University 

• Selects sensors (type/location) to optimize the fidelity and 
response of engine health diagnostics 

• Targets high risk engine anomaly types/classes 

• Assigns quantitative sensor suite value based on overall risk 
reduction, diagnostic speed, and probability of correct fault 
type/class isolation 

• Accommodates various types of models/physical inputs 

• Uses critical FMEA identified modes and risk assessments 

• Considers sensor response and system/signal noise effects 

• Accommodates fault scenarios from correlated test data 
and/or model simulations I 


84 Boost Stage 


Rocket Engine 


Systematic Sensor Selection Strategy 

S4 is a model-based procedure for systematically selecting an optimal sensor suite for overall health 
assessment of a given host system. S4 was developed in collaborative effort by the Controls and 
Dynamics Branch at NASA GRC and Christian Brothers University. Initial efforts to apply the 
technology focused on the Rocketdyne RS-83 and RS-84 boost stage liquid rocket engines. This 
systematic sensor selection strategy identified a minimum suite of 22 sensors (from a candidate set of 
59 sensors) that maximize risk reduction potential for the RS-84 engine. 

Sensor data are the basis for performance and health assessment of most complex systems. 

Therefore, careful selection and implementation of sensors is critical to enable high fidelity system 
health assessment. S4 is designed with these considerations in mind. 

S4 can be logically partitioned into three major subdivisions: the knowledge base, the down-select 
iteration, and the final selection analysis. The knowledge base consists of system design information 
and heritage experience together with a focus on components with health implications. The sensor 
suite down-selection identifies a group of sensors that provide good fault detection and isolation for 
targeted fault scenarios. This process is composed of three basic components: a system health 
diagnostic model, a merit algorithm, and a selection algorithm. In the final selection analysis, a 
statistical evaluation algorithm provides the final robustness test for each down-selected sensor suite. 

Though this systematic sensor selection process was developed to enhance design phase planning 
and preparation for in-space propulsion health management, the S4 process can also be applied to a 
broad range of non-propulsion health management systems (e.g., power, communications) that are 
part of the Exploration Systems architecture. 

Ref: Santi, L.M., Sowers, T.S., Aguilar, R.B., “ Optimal Sensor Selection for Health Monitoring 
Systems ”, 41st Joint Propulsion Conference and Exhibit, AIAA 2005-4485, July 2005. 
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Sensor Data Validation 


Data Qualification Validation Studio (DQVS ™) 

Developed in collaboration with 
Expert Microsystems, Inc. 

• Real-time detection of sensor failures and other data anomalies 

• Rapid model prototyping enabled by development studio 

• Uses analytical redundancy models, statistical limit filters and 
Bayesian fault decisions 

• Provides operating mode partitioning and generalized data 
interfaces 




Glenn Research Center at Lewis Field 





Sensor Data Qualification and Validation 

Sensor data qualification and validation is the process of analyzing sensor data to insure that it 
accurately represents the system state being measured. NASA Glenn has developed and implemented 
a number of sensor qualification and validation technologies, e.g. Neural Networks, Model-Based 
Analytical Redundancy, Kalman Filters and Wavelets. These methods are used not only to identify 
hard sensor failures, but also soft sensor failures, such as drift and noise. 

Data validation is an important element in the health assessment process. The goals of a sensor 
validation system are to prevent safety system false alarms, unnecessary shutdowns, or improper 
system responses by ensuring that automated health management systems “reason” with valid data. 
Proper fault detection and isolation can only be performed when information provided by the sensors 
is valid. Therefore, an initial analysis of sensor data to filter beyond simple off-scale data is crucial to 
any HM system performance. 

For one such project, NASA Glenn partnered with Aerojet and Expert Microsystems to develop an 
advanced sensor validation technology that utilized a Bayesian Belief network to provide real-time 
solutions for RS-83 and RS-84 propulsion systems. This technology incorporated the analytical 
redundancy relationships between all the sensors in the engine to establish a belief network that 
would identify faulty sensors and a level of confidence of this identification. The result of this effort 
is contained within a commercially available software suite, The Data Quality Validation Studio™ 
produced by Expert Microsystems, Inc. NASA Glenn’s Controls and Dynamics Branch supported 
the development and gained expertise in the use of the software by providing space shuttle main 
engine domain expertise, models for sensor relationships, and by conducting validation testing of the 
new sensor failure detection algorithms. 

Data validation is vital for any system that relies solely on sensor information to evaluate system 
performance and to assess system health. For Exploration Systems Missions where automation and 
remediation are based exclusively on sensor data and limited human input, advancement of these 
technologies to ensure optimum implementation, development and certification is required. 

Ref: Bickford, R. L., et al., “Real-Time Flight Data Validation for Rocket Engines”, 3 2rd Joint 
Propulsion Conference, AIAA/ASME/SAE/ASEE, 96-2827, July 1996.. 
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Fault Detection and Isolation 

Real-Time and Post-Test Diagnostic System 

Inverse Model for Fault Detection and Isolation 
Developed in collaboration with Christian Brothers University 

• Model-based approach suitable for general system application 

• Supports real-time and post-test diagnostic requirements 

• Provides fault class (component/LRU/response group) isolation capability with 
compatible sensor suites 

• Utilizes engine image model at complexity level consistent with real-time 
diagnostic constraint 

• Accommodates control effects and low order fault dynamics 
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Model Inversion for Fault Detection and Isolation 

Model inversion is the process whereby system states are identified from measurement values rather 
than the converse which is typical of the modeling process. An inverse model for fault detection and 
isolation in rocket engines was developed collaboratively by NASA Glenn’s Controls and Dynamics 
Branch and Christian Brothers University as part of a health management system for NASA’s Next 
Generation Launch Technology program. The inverse model framework is a component of the 
Systematic Sensor Selection Strategy (S4) mentioned previously. 

The algorithms that effect inversion are referred to as inverse models (IM). The core of any inverse 
model is a parameter optimization algorithm whose function is to determine component performance 
that best reconcile system model prediction and observation. Diagnosis of system condition and 
conclusions related to health status are inferred from the magnitude and/or variance of health 
parameter excursions from the accepted norm. Most common model-based techniques that assign 
health status to parameter state estimates can be classified within the inverse model framework. This 
would include the broad class of influence methods as well as state space techniques and various 
hybrid model-based strategies. 

An inverse model may be constructed to accommodate system nonlinearity, system dynamic 
response, and external control inputs at nearly any level of detail required. For each specific 
application, the appropriate inverse model form is suggested by the trading of diagnostic response 
time and state discrimination level. It is important to note that the design, maintenance, control, and 
health monitoring functions can all be supported by inverse models. Therefore the development of a 
robust inverse model for a given Exploration Systems application will likely support all diagnostic 
functions at some level. 

The reader should note that references on this effort are currently unavailable as reporting of this 
work is in progress. 
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Fault Detection and Isolation 

Real-Time Diagnostic System 


Propulsion IVHM Technology Experiment 
(PITEX) 

GRC-led Developed in collaboration with 
Ames Research Center and Kennedy 
Space Center 

• Real-Time Diagnosis of Faults 

• Inclusion of Real-World Effects 

• Demonstrated on Flight-Like Hardware 

• Applicable to Relevant Exploration Subsystems 
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Propulsion IVHM Technology Experiment 

The Propulsion IVHM Technology Experiment (PITEX) is a real-time model-based diagnostic 
system for the main propulsion system of the X-34 reusable launch vehicle, a space-launch 
technology demonstrator. PITEX was developed by a multi-center team led by NASA Glenn. 

During development, the Controls and Dynamics Branch was responsible for acquiring knowledge of 
the system, for developing signal processing algorithms and feed system simulations, for providing 
failure scenario data, and for conducting extensive testing and evaluation. 

PITEX was demonstrated in a simulation-based environment that used detailed models of the 
propulsion subsystem to generate nominal and failure scenarios during captive carry - the most 
safety-critical portion of the X-34 flight. Since no system-level testing of the X-34 Main Propulsion 
System (MPS) was performed, these simulated data were used to verify and validate the software 
system. Advanced diagnostic and signal processing algorithms were developed and tested in real- 
time on flight-like hardware. In an attempt to expose potential performance problems, these PITEX 
algorithms were subject to numerous real-world effects in the simulated data including noise, sensor 
resolution, command/valve talkback information, and nominal build variations. The current research 
has demonstrated the potential benefits of model-based diagnostics, defined the performance metrics 
required to evaluate the diagnostic system, and studied the impact of real-world challenges 
encountered when monitoring propulsion subsystems. 

PITEX has applicability to a wide variety of long duration systems, especially propulsion systems, 
that are likely to be part of NASA’s Exploration Systems Program. 

Ref: Maul, W. A., et al, “Addressing the Real-World Challenges in the Development of Propulsion 
IVHM Technology Experiment (PITEX) ”, First Intelligent Systems Technical Conference, AIAA, 
September 2004. 
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Information Fusion for Extended Gas Path Analysis Capability 

Information, or data, fusion is the ability to align data from similar and disparate sources in time and 
use those data to perform higher-level system diagnosis. In this area, expertise within NASA 
Glenn’s Controls and Dynamics Branch is historically found on the aeronautics, rather than the 
space, side of the house. Under NASA’s Aviation Safety Program, NASA and Pratt & Whitney 
(P&W) are collaborating to develop Information Fusion technologies. 

A wealth of aircraft turbine engine data is available from a variety of sources including on-board 
sensor measurements, operating histories, and component models. Furthermore, additional data will 
become available, as advanced prognostic sensors are incorporated into next generation gas turbine 
engine systems. The challenge is how to maximize the meaningful information extracted from these 
disparate data sources to obtain enhanced diagnostic and prognostic information regarding the health 
and condition of the engine. 

To address this challenge, NASA and Pratt & Whitney (P&W) have developed a modular 
hierarchical information fusion architecture. To demonstrate the efficacy of this architecture, a fusion 
demonstration of two gas path analysis algorithms, the Enhanced Self-Tuning Onboard Real-time 
Model (eSTORM) and a neural network-based Gas Path Anomaly Detector (GPAD), was performed. 
The architecture used to fuse these two algorithms is shown above. This fusion allows the system to 
detect and isolate both sensor and component faults. Furthermore, once a sensor fault is detected, it is 
accommodated by replacing the faulty physical measurement with a estimated value. This allows the 
system to continue to accurately estimate component performance even in the presence of a sensor 
fault. 

Data Fusion is an enabling technology for long duration missions where self diagnosis of very 
complex systems may be the difference between mission success and failure. 

Ref: Volponi, Allan J. et al, “ Development of an Information Fusion System for Engine Diagnostics 
and Health Management, ” Prepared for the 39th Combustion/27 th Airbreathing Propulsion/2 1st 
Propulsion Systems Hazards/3rd Modeling and Simulation Joint JANNAF Subcommittee Meeting 
Colorado Springs, Colorado, December 1-5, 2003 
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Health Management System 
Verification and Validation 


Data Qualification and Validation Test-Bed 

Developed by GRC • Fidelity/timeliness of sensor fault detection capability 

• Discriminate between sensor faults and anomalous plant states • Allows rapid, yet extensive, HMS prototype evaluation 

• Evaluate Performance of DQV Procedures • Flexible framework for evolving needs 



Data Qualification and Validation Test-Bed 

On-line data validation, one aspect of system verification and validation, is a performance- enhancing 
component of modem control and health management systems. It is essential that performance of the 
data validation system be verified prior to its use in a flight-rated control and health management 
system. A new Data Qualification and Validation (DQV) Test-Bed application was developed by 
NASA Glenn’s Controls and Dynamics Branch to provide a systematic test environment for this 
performance verification. The DQV Test-Bed was used to evaluate a model-based data validation 
package being employed as the data validation component of a rocket engine health management 
system. 

Four major modules compose the test-bed framework. The Test Manager Module defines the test 
conditions and controls the overall execution of the test sequence. Test data is provided by the Data 
Source Module. The Data Validation Module manages the system under test (SUT). The Analysis 
and Reporting Module evaluates the output from the SUT using the known test conditions and 
generates a series of reports summarizing the results. 

The DQV Test-Bed was shown to be an effective tool for reducing development time and providing 
comprehensive testing of a health monitoring system for the RS-84 propulsion system. It provides an 
efficient avenue for assessing the strengths and weaknesses of prototype data validation and fault 
detection systems by improving the understanding of those systems’ capabilities and trade-offs. The 
DQV Test-Bed provides a potentially useful and important element of the necessary infrastructure to 
iteratively develop and flight-qualify health management systems for NASA Exploration Systems 
Program. 


Ref: Sowers, T.S., Santi, L.M., Bickford, R.L., “ Performance Evaluation of a Data Validation 
System ”, 41st AIAA/ASME/SAE/ASEE Joint Propulsion Conference and Exhibit, AIAA 2005-4486, 
July 2005. 


NAS A/TM— 2005-2 1 4026 



Propulsion HM Historical Perspective 


Automated Data 
Reduction/Feature 
Extraction (SSME) 


DQVS (SSME) 
PCCS (IPTD) 




1988 


1990 


1992 


1994 


1996 


1998 


2000 


2002 


2004 


2006 


PTDS (SSME) 


Atlas/Centaur 
Automated Diagnostic 
System (ACADS) 


PTDS (X-33) 


DQVS (RS-83/84) 


Optimal HM System Design Experience 



Sensor Selection, 
Validation, 
Inverse Model 
(MC-1, RS-83/84) 
Automated Real-Time Diagnostic System 


£ 


- Systematic Sensor Selection for MC-1 , RS-83 

and RS-84 


- Testability Analysis for X-34 Main Propulsion 
System & Non-Toxic Reaction Control System 

Sensor Validation 


Inverse Engine Model for MC-1, RS-83 and RS-84 

Propulsion IVHM Technology Experiment (PITEX) for 
X-34 Main Propulsion System 

Propulsion Check Out and Control System (PCCS) for 
Integrated Propulsion Technology Demonstrator (IPTD) 


- Data Qualification using Data Qualification 

Validation Studio (DQVS) for SSME, RS-83 and 
RS-84 


Atlas/Centaur Automated Diagnostic System (ACADS) 
monitoring and analysis of Centaur pneumatic system 


- Sensor Validation for SSME, X-33 Aerospike 
engine & Integrated Propulsion Technology 
Demonstrator (IPTD) 


Automated Post Flight Diagnostic System 

- Rocketdyne X-33 Aerospike Engine 

Post Test Diagnostic System (PTDS) for SSME ground tests 


Nearly Two Decades Experience Building and Deploying Health 
Management Solutions for Power and Propulsion Systems 


Glenn Research Center at Lewis Field 



Conclusion 

The Controls and Dynamics Branch at the NASA Glenn Research Center has been involved in the 
development and application of critical health management technologies for aerospace propulsion 
systems for almost two decades. These technologies have been applied in real-time and non-real- 
time analyses and have included conventional and non-conventional techniques. The Branch has 
recently broadened its focus to include propellant and reactant feed systems, power distribution 
systems, and environmental control systems. While each subsystem has its own unique constraints 
and issues, there also exists an underlying commonality in the development and implementation of 
the their health management systems. Each subsystem requires that . . . 

• the health management system developers acquire extensive knowledge and that they 
develop an intimate understanding of the subsystem’s operation; 

• health management system development take place in parallel with development of the 
monitored system to achieve optimal effectiveness; 

• techniques in addressing optimum sensor placement, fault detection and isolation and 
information fusion, be developed and implemented based upon the unique constraint 
implied by the monitored system itself and imposed by the application or mission; 

• each health management system implemented be verified and validated to the satisfaction 
of the systems’ designers and developers. 

NASA Glenn’s has a rich legacy of health management research in both aeronautics and space to 
draw upon when developing Integrated Health Management Systems for future exploration 
missions. 

Ref: Garg, S., “ Controls and Health Management Technologies for Intelligent Aerospace Propulsion 
Systems ”, 42nd AIAA Aerospace Sciences Meeting and Exhibit, AIAA-2004-0949, January 2004. 
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